feat: Added examples for network security group with flow logs.

.github/dependabot.yml

@@ -10,7 +10,15 @@ updates:
     schedule:
       interval: "weekly"
   - package-ecosystem: "terraform" # See documentation for possible values
-    directory: "_example" # Location of package manifests
+    directory: "_example/basic" # Location of package manifests
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "terraform" # See documentation for possible values
+    directory: "_example/complete" # Location of package manifests
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "terraform" # See documentation for possible values
+    directory: "_example/nsg-with-flow-logs" # Location of package manifests
     schedule:
       interval: "weekly"
 

.github/workflows/semantic-releaser.yml

@@ -6,7 +6,7 @@ on:
       - main
     paths:
       - '**.tf'
-      - '!examples/**.tf'
+      - '_examples/**.tf'
 
 jobs:
   release:

.github/workflows/static-checks.yml

@@ -30,7 +30,9 @@ jobs:
           - ${{ needs.versionExtract.outputs.minVersion }}
           - ${{ needs.versionExtract.outputs.maxVersion }}
         directory:
-          - _example/
+          - _example/basic/
+          - _example/complete/
+          - _example/nsg-with-flow-logs/
 
     steps:
       - name: Checkout

README.yaml

@@ -38,8 +38,7 @@ usage: |-
   Here is an example of how you can use this module in your inventory structure:
     ```hcl
      module "network_security_group" {
-      source                  = "clouddrove/subnet/network-security-group"
-      version                 = "1.0.0"
+      source                  = "clouddrove/network-security-group/azure"
       app_name                = "app"
       environment             = "test"
       resource_group_location = module.resource_group.resource_group_location

_example/basic/example.tf

@@ -0,0 +1,39 @@
+##----------------------------------------------------------------------------- 
+## Network Security Group module call. 
+##-----------------------------------------------------------------------------
+module "network_security_group" {
+  depends_on              = [module.subnet]
+  source                  = "../../"
+  name                    = "app"
+  environment             = "test"
+  resource_group_name     = module.resource_group.resource_group_name
+  resource_group_location = module.resource_group.resource_group_location
+  subnet_ids              = module.subnet.default_subnet_id
+  inbound_rules = [
+    {
+      name                  = "ssh"
+      priority              = 101
+      access                = "Allow"
+      protocol              = "Tcp"
+      source_address_prefix = "10.20.0.0/32"
+      #source_address_prefixes    = ["10.20.0.0/32","10.21.0.0/32"]
+      source_port_range          = "*"
+      destination_address_prefix = "0.0.0.0/0"
+      destination_port_range     = "22"
+      description                = "ssh allowed port"
+    },
+    {
+      name                       = "https"
+      priority                   = 102
+      access                     = "Allow"
+      protocol                   = "*"
+      source_address_prefix      = "VirtualNetwork"
+      source_port_range          = "80,443"
+      destination_address_prefix = "0.0.0.0/0"
+      destination_port_range     = "22"
+      description                = "ssh allowed port"
+    }
+  ]
+  enable_diagnostic          = true
+  log_analytics_workspace_id = module.log-analytics.workspace_id
+}

_example/basic/outputs.tf

@@ -0,0 +1,9 @@
+output "security_group_id" {
+  value       = module.network_security_group.id
+  description = "Specifies the name of the network security group. Changing this forces a new resource to be created."
+}
+
+output "security_group_name" {
+  value       = module.network_security_group.name
+  description = "The name of the resource group in which to create the network security group. Changing this forces a new resource to be created."
+}

_example/example.tf → _example/complete/example.tf

@@ -1,42 +1,55 @@
-# Azure Provider configuration
 provider "azurerm" {
   features {}
 }
 
+locals {
+  name        = "app"
+  environment = "test"
+  label_order = ["name", "environment"]
+}
+
+##----------------------------------------------------------------------------- 
+## Resource Group module call
+## Resource group in which all resources will be deployed.
+##-----------------------------------------------------------------------------
 module "resource_group" {
   source      = "clouddrove/resource-group/azure"
   version     = "1.0.2"
-  name        = "app"
-  environment = "test"
-  label_order = ["name", "environment", ]
+  name        = local.name
+  environment = local.environment
+  label_order = local.label_order
   location    = "Canada Central"
 }
 
+##----------------------------------------------------------------------------- 
+## Virtual Network module call.
+##-----------------------------------------------------------------------------
 module "vnet" {
   depends_on          = [module.resource_group]
   source              = "clouddrove/vnet/azure"
-  version             = "1.0.2"
-  name                = "app"
-  environment         = "test"
+  version             = "1.0.3"
+  name                = local.name
+  environment         = local.environment
   resource_group_name = module.resource_group.resource_group_name
   location            = module.resource_group.resource_group_location
   address_space       = "10.30.0.0/22"
 }
 
+##----------------------------------------------------------------------------- 
+## Subnet Module call. 
+## Subnet to which network security group will be attached. 
+##-----------------------------------------------------------------------------
 module "subnet" {
-  source  = "clouddrove/subnet/azure"
-  version = "1.0.2"
-
-  name                 = "app"
-  environment          = "test"
+  source               = "clouddrove/subnet/azure"
+  version              = "1.0.2"
+  name                 = local.name
+  environment          = local.environment
   resource_group_name  = module.resource_group.resource_group_name
   location             = module.resource_group.resource_group_location
   virtual_network_name = join("", module.vnet.vnet_name)
-
   # Subnet Configuration
   subnet_names    = ["subnet"]
   subnet_prefixes = ["10.30.0.0/24"]
-
   # routes
   enable_route_table = true
   route_table_name   = "default_subnet"
@@ -48,15 +61,18 @@ module "subnet" {
       next_hop_type  = "Internet"
     }
   ]
-
 }
 
+##----------------------------------------------------------------------------- 
+## Log Analytics module call. 
+## Log Analytics workspace in which network security group diagnostic setting logs will be received. 
+##-----------------------------------------------------------------------------
 module "log-analytics" {
   source                           = "clouddrove/log-analytics/azure"
   version                          = "1.0.1"
-  name                             = "app"
-  environment                      = "test"
-  label_order                      = ["name", "environment"]
+  name                             = local.name
+  environment                      = local.environment
+  label_order                      = local.label_order
   create_log_analytics_workspace   = true
   resource_group_name              = module.resource_group.resource_group_name
   log_analytics_workspace_location = module.resource_group.resource_group_location
@@ -65,12 +81,14 @@ module "log-analytics" {
   log_analytics_workspace_id = module.log-analytics.workspace_id
 }
 
+##----------------------------------------------------------------------------- 
+## Network Security Group module call. 
+##-----------------------------------------------------------------------------
 module "network_security_group" {
-  depends_on  = [module.subnet]
-  source      = "../"
-  name        = "app"
-  environment = "test"
-
+  depends_on              = [module.subnet]
+  source                  = "../../"
+  name                    = local.name
+  environment             = local.environment
   resource_group_name     = module.resource_group.resource_group_name
   resource_group_location = module.resource_group.resource_group_location
   subnet_ids              = module.subnet.default_subnet_id
@@ -99,6 +117,6 @@ module "network_security_group" {
       description                = "ssh allowed port"
     }
   ]
-
+  enable_diagnostic          = true
   log_analytics_workspace_id = module.log-analytics.workspace_id
 }

_example/nsg-with-flow-logs/example.tf

@@ -0,0 +1,140 @@
+provider "azurerm" {
+  features {}
+}
+
+locals {
+  name        = "app"
+  environment = "test"
+  label_order = ["name", "environment"]
+}
+
+##----------------------------------------------------------------------------- 
+## Resource Group module call
+## Resource group in which all resources will be deployed.
+##-----------------------------------------------------------------------------
+module "resource_group" {
+  source      = "clouddrove/resource-group/azure"
+  version     = "1.0.2"
+  name        = local.name
+  environment = local.environment
+  label_order = local.label_order
+  location    = "Canada Central"
+}
+
+##----------------------------------------------------------------------------- 
+## Virtual Network module call.
+##-----------------------------------------------------------------------------
+module "vnet" {
+  depends_on             = [module.resource_group]
+  source                 = "clouddrove/vnet/azure"
+  version                = "1.0.3"
+  name                   = local.name
+  environment            = local.environment
+  resource_group_name    = module.resource_group.resource_group_name
+  location               = module.resource_group.resource_group_location
+  address_space          = "10.30.0.0/22"
+  enable_network_watcher = true
+}
+
+##----------------------------------------------------------------------------- 
+## Subnet Module call. 
+## Subnet to which network security group will be attached. 
+##-----------------------------------------------------------------------------
+module "subnet" {
+  source               = "clouddrove/subnet/azure"
+  version              = "1.0.2"
+  name                 = local.name
+  environment          = local.environment
+  resource_group_name  = module.resource_group.resource_group_name
+  location             = module.resource_group.resource_group_location
+  virtual_network_name = join("", module.vnet.vnet_name)
+  # Subnet Configuration
+  subnet_names    = ["subnet"]
+  subnet_prefixes = ["10.30.0.0/24"]
+  # routes
+  enable_route_table = true
+  route_table_name   = "default_subnet"
+  # routes
+  routes = [
+    {
+      name           = "rt-test"
+      address_prefix = "0.0.0.0/0"
+      next_hop_type  = "Internet"
+    }
+  ]
+}
+
+##----------------------------------------------------------------------------- 
+## Storage Module call. 
+## Storage account in which network security group flow log will be received.
+##-----------------------------------------------------------------------------
+module "storage" {
+  source               = "clouddrove/storage/azure"
+  version              = "1.0.8"
+  name                 = local.name
+  environment          = local.environment
+  default_enabled      = true
+  resource_group_name  = module.resource_group.resource_group_name
+  location             = module.resource_group.resource_group_location
+  storage_account_name = "stordtyre236"
+  ##   Storage Container
+  containers_list = [
+    { name = "app-test", access_type = "private" },
+    { name = "app2", access_type = "private" },
+  ]
+  ##   Storage File Share
+  file_shares = [
+    { name = "fileshare1", quota = 5 },
+  ]
+  ##   Storage Tables
+  tables = ["table1"]
+  ## Storage Queues
+  queues                   = ["queue1"]
+  management_policy_enable = true
+  #enable private endpoint
+  virtual_network_id = module.vnet.vnet_id[0]
+  subnet_id          = module.subnet.default_subnet_id[0]
+  enable_diagnostic  = false
+}
+
+##----------------------------------------------------------------------------- 
+## Network Security Group module call. 
+##-----------------------------------------------------------------------------
+module "network_security_group" {
+  depends_on                  = [module.subnet]
+  source                      = "../../"
+  name                        = local.name
+  environment                 = local.environment
+  resource_group_name         = module.resource_group.resource_group_name
+  resource_group_location     = module.resource_group.resource_group_location
+  subnet_ids                  = module.subnet.default_subnet_id
+  enable_flow_logs            = true
+  network_watcher_name        = module.vnet.network_watcher_name
+  flow_log_storage_account_id = module.storage.default_storage_account_id
+  enable_traffic_analytics    = false
+  inbound_rules = [
+    {
+      name                  = "ssh"
+      priority              = 101
+      access                = "Allow"
+      protocol              = "Tcp"
+      source_address_prefix = "10.20.0.0/32"
+      #source_address_prefixes    = ["10.20.0.0/32","10.21.0.0/32"]
+      source_port_range          = "*"
+      destination_address_prefix = "0.0.0.0/0"
+      destination_port_range     = "22"
+      description                = "ssh allowed port"
+    },
+    {
+      name                       = "https"
+      priority                   = 102
+      access                     = "Allow"
+      protocol                   = "*"
+      source_address_prefix      = "VirtualNetwork"
+      source_port_range          = "80,443"
+      destination_address_prefix = "0.0.0.0/0"
+      destination_port_range     = "22"
+      description                = "ssh allowed port"
+    }
+  ]
+}